Check Point Patches Actively Exploited Security Management Server Zero-Day

En bref

• CVE-2026-93616 lets unauthenticated attackers execute scripts through a web service on Check Point Security Management Server.
• Exploitation was observed in a small number of targeted attacks, starting July 23, 2026.
• Check Point released a fix on September 22, 2026, and warned customers to update.
• Firewall policy management systems are high-value targets because they control network defenses.

Check Point has disclosed that a previously unknown flaw, tracked as CVE-2026-93616, was used in real-world intrusions against its Security Management Server. The bug allows an adversary to reach a web service and execute scripts without providing credentials. Because that server is where firewall policies are configured and pushed to enforcement points, compromise can undermine an organization's entire network security posture.

According to the vendor, only a small number of targeted attacks have been tied to the issue. Exploitation activity was first seen on July 23, 2026. Check Point responded by developing a fix, which became available on September 22, 2026, and it has warned customers to apply the update promptly.

K-12 districts and other government entities that rely on Check Point to manage perimeter and internal firewall rules are in scope. An attacker who gains script execution on the management server could alter policies, disable protections, or use the server as a pivot into other systems. Even if the initial intrusion is limited, the management plane is a high-value target because it controls trust boundaries.

The window between observed exploitation and patch release is notable. Defenders should assume that unpatched management interfaces were probed or attacked, and they should review logs for unexpected web requests, new administrative activity, and policy changes. Because the flaw requires no authentication, exposure to the internet or untrusted networks increases risk.

Watch for further vendor guidance, proof-of-concept code, and reports of additional victims. Organizations should prioritize patching, restrict management access, and verify that firewall policies have not been tampered with.

À faire maintenant

1. Apply the Check Point fix for CVE-2026-93616 immediately; if patching is delayed, isolate the Security Management Server from untrusted networks.
2. Restrict web service access to trusted administrative networks and require VPN or jump host for management.
3. Review logs from July 23 onward for unauthenticated requests, unusual script execution, and unexpected admin sessions.
4. Audit firewall policies and compare against known-good baselines to detect unauthorized changes.
5. Rotate credentials and API keys for management server accounts and integrated systems.
6. Enable multi-factor authentication and least privilege for all administrative access.
7. Monitor vendor advisories and threat intel for exploitation attempts or PoC code targeting CVE-2026-93616.

Références CVE

• CVE-2026-93616

Source originale

The Hacker News